Monday, 29 April 2013

Fake carding shops

Nothing new here, just three forums used to scam stupid people like carders.
It's always the same method: advertising via spam and to view the content you must pay a fee.

Our first forum is a phpbb with fake statistic.
• dns: 1 ›› ip: - adresse: FORUMSCC.COM

Forum look's huge:

Users are charged a $0.5 LR fee to view forums:

Fake online users:

Second example, fake carding shop:
• dns: 1 ›› ip: - adresse: MARALIMACLASSIC.COM.BR

The captcha is iframed:

When you complete the name field and click login you are redirected always to register.html

The site index is defaced by a random lammer:


When you click to register you are redirected on a fake Liberty Reserve page:
• dns: 1 ›› ip: - adresse: SCI.LIBIRTYRESERVES.COM

Another fake site, probably do by the same guys:
Some other files found on the compromised server, cPanel bruteforcer:
Another cPanel bruteforcer:
Ac1db1tch3z x86/x64 Linux kernel exploit (EXP/Linux.Small.AU):

The mail lead here:
• dns: 1 ›› ip: - adresse: ZCB.CO.IN
And when you click on register...
• dns: 1 ›› ip: - adresse: SCII.LIBERTYERESERVE.COM

PHP stuff can be found here:
EXP/Linux.Small.AU here:


  1. complementing xilibox, some hackers station having fun because email accounts and lr these scammers have been hacked, and he cocerteza website owner, mtfucker scammer,

  2. this website and vulnerable to DOS attacks and SQLinjection, verify,,